Human ressources
Can I maintain a file listing the political affiliation of my employees?
No, a person's political affiliation is part of the « sensitive data » defined in Article 2 of Law No. 1.565 of December 3, 2024, as « personal data that directly or indirectly reveal political opinions or affiliations, racial or ethnic origins, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person's identity, or data concerning a person's health, sexual life, or sexual orientation."»
Collecting and processing such data are, except for exceptions, prohibited and constitute a criminal offense.
To learn more:
Can I recruit my employees using a fully automated process?
No, if a first screening of resumes can, for example, be done automatically, human intervention is necessary at a later stage of the process.
Indeed, under Article 19 of the Law, «The data subject has the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them. »
A data subject cannot be the subject of a decision that is based solely on automated processing, without any human intervention, when the decision produces legal implications to the person or significantly affects them.
This right is thus intended to protect the data subject (for example, a job applicant) against decisions that impact their rights and freedoms by influencing their environment, behavior, and choice, or resulting in discrimination.
In any cases, applicants must be informed of the use of an automated process.
To learn more:
Can I request any documents I want from job applicants?
No, you can only ask for the documents necessary and relevant to the related job position. For example, you cannot ask for a copy of a driver's license for a job that does not require the use of a vehicle.
This is the principle of data minimization principle, which is one of the 6 essential principles provided for in Article 4 of Law No. 1.565 of December 3, 2024 related to the protection of personal data, which all data controllers must comply with.
The data controller must ensure that the data collected are limited to the purpose of the processing.
To comply with this principle, the personal data collected must be:
- adequate;
- relevant;
- limited to what is necessary in relation to the purposes for which they are processed.
To learn more: factsheet The main principles of personal data protection
Can I ask my employee for details about their health?
No, this information is considered « sensitive data » as defined by the Article 2 of Law No. 1.565 of December 3, 2024, as « personal data that directly or indirectly reveal opinions or political affiliations, racial or ethnic origins, religious or philosophical beliefs, union membership, or genetic data, biometric data for the purpose of uniquely identifying an individual, or data concerning the health, sexual life, or sexual orientation of an individual. »
Collecting and processing such data are, except for exceptions, prohibited and constitute a criminal offense.
Only within the context of occupational medicine will you be informed if your employee is fit for their job, fit with restrictions, or unfit.
To learn more:
How long can I keep the file of a candidate who was not selected?
For candidates that were not selected, up to 2 years after the last contact.
Indeed, under the principle of data retention limitation, the data collected cannot be retained indefinitely in a form allowing the identification of the data subjects.
The data controller must imperatively sort through the documents contained in this file.
Thus, CVs, cover letters, diplomas, and evaluations can indeed be kept for 2 years after the last contact.
Furthermore, it is important to note that if the candidate is hired, all the information from the file is then integrated into their employee file.
To learn more: